A bind variable is a parameter value supplied to a database query separately from the SQL text. Instead of building a statement by concatenating user input, the application prepares the query shape and binds the input as data. The database then treats that value as a literal, not as executable SQL.
Bind variables matter because they are one of the most effective defenses against SQL injection. They prevent attackers from changing the structure of a query, which blocks common payloads that try to add extra clauses, subqueries, or command-like SQL fragments. In real systems, secure code uses bind variables for search fields, login forms, and API filters; insecure code often substitutes string concatenation or dynamic SQL. In Oracle environments, bind variables are especially important when applications use shared accounts or powerful server-side routines, because reducing query malleability helps limit the damage an injected statement can do.